diff --git a/src/config.rs b/src/config.rs index 0241d80..c7e7663 100644 --- a/src/config.rs +++ b/src/config.rs @@ -85,6 +85,9 @@ pub struct ExecutableSpec { /// Requires `no_new_privs = true`. #[serde(default)] pub seccomp: Option, + + /// An optional out-of-memory score adjustment value. + pub oom_score_adj: Option, } #[derive(Default, Debug, Serialize, Deserialize)] diff --git a/src/runner.rs b/src/runner.rs index 6bf06be..3d1ffdb 100644 --- a/src/runner.rs +++ b/src/runner.rs @@ -97,6 +97,11 @@ impl AttachRequestBuilder { self } + pub fn set_oom_score_adj(mut self, score: i32) -> AttachRequestBuilder { + self.config.exec.oom_score_adj = Some(score); + self + } + pub fn push_namespace(mut self, ns: Namespace) -> AttachRequestBuilder { if self.config.namespaces.is_none() { self.config.namespaces = vec![].into(); @@ -211,6 +216,11 @@ impl CreateRequestBuilder { self } + pub fn set_oom_score_adj(mut self, score: i32) -> CreateRequestBuilder { + self.config.exec.oom_score_adj = Some(score); + self + } + pub fn set_hostname(mut self, hostname: &str) -> CreateRequestBuilder { self.config.hostname = hostname.to_string().into(); self diff --git a/src/wrap.rs b/src/wrap.rs index fbe8b84..efee1d0 100644 --- a/src/wrap.rs +++ b/src/wrap.rs @@ -639,6 +639,11 @@ impl Wrappable for CreateRequest { debug!("mount tree finalized, doing final prep"); + // Ensure the process receives the desired out-of-memory score adjustment. + if let Some(score) = self.exec.oom_score_adj { + fs::write("/proc/self/oom_score_adj", score.to_string())?; + } + // We need to toggle SECBIT before we change UID/GID, // or else changing UID/GID may cause us to lose the capabilities // we need to explicitly drop capabilities later on. @@ -841,6 +846,11 @@ impl Wrappable for AttachRequest { apply_capabilities(self.capabilities.as_ref())?; + // Ensure the process receives the desired out-of-memory score adjustment. + if let Some(score) = self.exec.oom_score_adj { + fs::write("/proc/self/oom_score_adj", score.to_string())?; + } + debug!("all namespaces joined -- forking child"); fork_and_wait()?;